3 ms·

"let's avoid having any laws governing the internet, because all governments are evil, corporations are good and ignorance is freedom!" /s

by rini17 5y ago

gruez 5y ago
But my argument against this regulation isn't that "all governments are evil, corporations are good", it's that with respect to certificate authorities, corporations are largely doing a pretty good job, in contrast to governments who are pushing encryption backdoors. If google/mozilla/apple are abusing their position and harming users through their CA programs, then I might consider regulation. But for now it looks like a power grab.
- rini17 5y ago
  Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? We have no idea so we happily live in illusion that they aren't pushing anything nefarious. Whereas the public lawmaking in democracies is messy, fueled by outrage and visible special interests.
  - gruez 5y ago
    >Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? I can be sure they're doing a good job, because I can see them doing a good job, and have no reason to believe they're suppressing any bad news. Are you making a theoretical argument here? In other words, are you simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things? As for transparency, AFAIK both google and mozilla have their certificate policy discussions available to the public, eg. https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs/m/El1mH8S6AwAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKw... >We have no idea so we happily live in illusion that they aren't pushing anything nefarious This sounds like argument from ignorance. ie. "we have no idea whether they're not pushing anything nefarious, therefore we should assume they're pushing something nefarious". If you think they're acting nefariously, by all means mention it here. Don't go beating around the bushes with vague accusations that they might be doing something bad, and use that to justify the government stepping in.
    - rini17 5y ago
      But vague accusations of government doing something bad are okay? Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago.
      - gruez 5y ago
        > But vague accusations of government doing something bad are okay? The government's past and current push to ban encryption (or similar efforts) aren't "vague". >Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago. You have to trust the browser makers regardless. If you want to prevent browser makers from going rogue (eg. sending your browsing data directly to them), you'd need far more comprehensive regulation than this. The only thing this does is force your browser to trust additional set of entities. In that respect, this legislation is quite pointless, because we haven't seen browser makers unfairly exclude upstart CAs. I suppose the regulation might be worth keeping around just in case, but I'm not really convinced of the cost/benefit. As I see it the benefit is that if browser makers decide to go rogue and exclude new CAs, this will allow EU and/or member states to issue their own certificates. The downside is that EU and/or member states can issue TLS certificates to MITM connections. Am I missing anything?

"let's avoid having any laws governing the internet, because all governments are evil, corporations are good and ignorance is freedom!" /s

by rini17 5y ago

"let's avoid having any laws governing the internet, because all governments are evil, corporations are good and ignorance is freedom!" /s

gruez 5y ago

But my argument against this regulation isn't that "all governments are evil, corporations are good", it's that with respect to certificate authorities, corporations are largely doing a pretty good job, in contrast to governments who are pushing encryption backdoors. If google/mozilla/apple are abusing their position and harming users through their CA programs, then I might consider regulation. But for now it looks like a power grab.

rini17 5y ago
Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? We have no idea so we happily live in illusion that they aren't pushing anything nefarious. Whereas the public lawmaking in democracies is messy, fueled by outrage and visible special interests.
- gruez 5y ago
  >Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? I can be sure they're doing a good job, because I can see them doing a good job, and have no reason to believe they're suppressing any bad news. Are you making a theoretical argument here? In other words, are you simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things? As for transparency, AFAIK both google and mozilla have their certificate policy discussions available to the public, eg. https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs/m/El1mH8S6AwAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKw... >We have no idea so we happily live in illusion that they aren't pushing anything nefarious This sounds like argument from ignorance. ie. "we have no idea whether they're not pushing anything nefarious, therefore we should assume they're pushing something nefarious". If you think they're acting nefariously, by all means mention it here. Don't go beating around the bushes with vague accusations that they might be doing something bad, and use that to justify the government stepping in.
  - rini17 5y ago
    But vague accusations of government doing something bad are okay? Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago.
    - gruez 5y ago
      > But vague accusations of government doing something bad are okay? The government's past and current push to ban encryption (or similar efforts) aren't "vague". >Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago. You have to trust the browser makers regardless. If you want to prevent browser makers from going rogue (eg. sending your browsing data directly to them), you'd need far more comprehensive regulation than this. The only thing this does is force your browser to trust additional set of entities. In that respect, this legislation is quite pointless, because we haven't seen browser makers unfairly exclude upstart CAs. I suppose the regulation might be worth keeping around just in case, but I'm not really convinced of the cost/benefit. As I see it the benefit is that if browser makers decide to go rogue and exclude new CAs, this will allow EU and/or member states to issue their own certificates. The downside is that EU and/or member states can issue TLS certificates to MITM connections. Am I missing anything?